Privacy Policy

This Privacy Policy explains how ProjectThunder.com, Inc. ("we", "us") handles personal information in connection with the BidGlory website and services. We do not sell or "share" personal information (as those terms are defined under the CCPA/CPRA).

1. Scope & roles

This policy covers information we handle as a business/controller — visitors to bidglory.com, account holders, and subscribers. For data a hosting customer enters into their BidGlory instance (bids, clients, catalog, etc.), the customer is the controller and we act only as a processor on the customer's instructions under the Subscription & Support Terms; that customer data is governed by the customer's own privacy practices.

2. Information we collect

• Account & community. Username, email, and a salted-hashed password; forum posts, comments, and votes you submit.
• Demo & contact. Name, company, email, phone (optional), trade, team size, and what you tell us.
• Billing. Subscriptions are processed by PayPal. We receive confirmation of a subscription and its status; we never receive or store your card or bank details — PayPal handles payment data under its own privacy policy.
• Usage. Privacy-friendly, cookieless web analytics (Cloudflare Web Analytics) — aggregate page and performance data, no cross-site tracking.
• Support. Correspondence and information you provide when you contact us.
• Site chat. Our website chat assistants (the BidGlory sales assistant and the independent legacy-BidMagic support assistant) ask for your name, company, email and optional phone before the first question, and we keep a verbatim record of every message in the conversation — both yours and the assistant's. Transcripts are read by our staff to check answer quality and to follow up with you.

3. The BidGlory apps for iPhone, iPad and Android

The BidGlory app for iPhone and iPad and the BidGlory app for Android, which is distributed through Google Play, are the same app. Each signs in to your company's BidGlory, so what you enter in it is that company's data (section 1). The app's own notice at bidglory.net/about/privacy gives the full device-level detail.

• What the app sends to BidGlory. Your user name or e-mail address and password when you sign in (the password is not stored on the device); your name and account ID; client and contact details you enter (names, e-mail addresses, phone numbers, postal addresses); photos you take and attach to a bid; the bids, items, notes and other content you type; and a sign-in record with the date and time, the IP address and the app identifier, kept to detect password guessing. All of it is linked to your account and used only to provide the app's features.
• What it does not do. No advertising or analytics SDK, no advertising ID, and no tracking across other companies' apps or websites. The Google Play build is made with crash reporting switched off and sends no crash reports. The app does not access your location, address book, photo library, microphone or calendar.
• Permissions. On iPhone and iPad the only permission it asks for is the camera, for a photo you choose to take for a bid. On Android it asks for internet access and network state (INTERNET and ACCESS_NETWORK_STATE), which Android grants without asking; the only other permission is one the AndroidX library adds for the app's own internal use, which only BidGlory-signed apps can hold and which Android never asks you about.
• In transit. The app connects to BidGlory only over HTTPS, so what it sends and receives is encrypted in transit.
• On the device. The session token is kept in the iOS Keychain, or on Android in storage encrypted with a key held in the Android Keystore. So the app keeps working without signal, it keeps a read cache and an outbox of unsent edits in SQLite databases in the app's private storage (a damaged outbox is renamed and kept, never deleted), excluded from iCloud and iTunes backups and, on Android, from Google cloud backup and device-to-device transfer. Signing out deletes the token, the read cache and any proposal files the app saved; unsent edits stay until you sign in again.
• Deleting your account. App accounts are created, and on request deleted and anonymized, by your company's BidGlory administrator (or by us, on a request to privacy@bidglory.com that your company confirms): the name, user name, e-mail, phone and password are erased and replaced, business records stay attributed to "Deleted user", proposals already sent to a customer are kept as sent, and free text someone typed (notes, descriptions, comments) is not searched or changed. See how to delete your BidGlory account for both ways to ask, and what is deleted and kept, including the agent access tokens you created (kept, but revoked when the account is deleted) and their call log (deleted after 90 days by default).

4. How we use it

To provide, secure, and improve the service; create and manage accounts and subscriptions; respond to demos and support; send service and transactional messages; prevent abuse and fraud; and comply with law. We may create and use aggregated or de-identified data (which is not personal information) for any lawful purpose, including improving BidGlory.

5. Legal bases (GDPR/UK GDPR)

Where the GDPR applies, we rely on: performance of a contract (to provide the service you request); legitimate interests (to run, secure, and improve our business, on balance with your rights); consent (where required, e.g. certain marketing — withdrawable at any time); and legal obligation.

6. Sharing & processors

We share personal information only with service providers who process it on our behalf under contract, including PayPal (payments), our hosting/email providers, Cloudflare (analytics), and Anthropic (the language model behind our website chat assistants). Two different things are described here, and the distinction matters: AI features inside the BidGlory product are opt-in and bring-your-own-model — bid contents are sent to a language-model endpoint only if you configure and invoke one. The chat assistants on this website are not opt-in in that sense: if you use one, what you type and the contact details you give are sent to Anthropic to generate a reply, and are stored by us as described above. Don't put confidential information into the website chat. We may disclose information to comply with law, enforce our terms, or protect our rights, and in a merger or asset sale. We do not sell or share personal information for cross-context behavioral advertising.

7. Retention

We keep personal information for as long as needed to provide the service and for legitimate business and legal purposes (e.g. accounts while active, plus a reasonable period; billing records as required by law). We may retain aggregated/de-identified data indefinitely. Website chat transcripts are retained so we can review answer quality and follow up on your enquiry; ask us at privacy@bidglory.com and we will delete yours.

8. Your rights

EEA/UK (GDPR): access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority. California (CCPA/CPRA): the right to know, delete, and correct personal information, to opt out of sale/sharing (we do none), and to non-discrimination for exercising your rights. Because we do not sell or share, no "Do Not Sell" action is required, but you may still exercise the other rights. Exercise any right by emailing privacy@bidglory.com; we will verify your request and respond within the timeframes required by law. For customer-controlled hosted data, direct requests to the relevant customer (the controller). To delete a BidGlory app account, see how to delete your BidGlory account.

9. International transfers

We operate in the United States, and information may be processed there and by our providers. Where required, transfers rely on appropriate safeguards such as the Standard Contractual Clauses.

10. Security

We use reasonable technical and organizational measures — passwords are salted and hashed (PBKDF2), API tokens are stored only as hashes, and access is restricted. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

11. Children

BidGlory is a business tool not directed to children under 16, and we do not knowingly collect their personal information.

12. Changes

We may update this policy from time to time; the effective date above will change and, where required, we will provide notice. Continued use after the effective date constitutes acceptance.

13. Contact

Questions or requests: privacy@bidglory.com, ProjectThunder.com, Inc. This policy is governed by the laws of the State of California, consistent with our other terms.